Crypto Regulation in Hong Kong: 2026 Update

Crypto regulation in Hong Kong is among the most developed in Asia, built on a mandatory licensing regime for virtual asset service providers and a clear policy of regulated market access rather than prohibition. The Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) jointly anchor the framework, covering exchanges, stablecoins, over-the-counter desks and custody providers. This guide explains the current rules, recent legislative changes, licensing requirements, compliance obligations, and the practical steps any operator or investor must understand before entering the Hong Kong market.

Hong Kong';s approach to digital assets is built on a dual-regulator model. The SFC oversees virtual asset trading platforms (VATPs) and securities-type tokens under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), as amended by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance. The HKMA governs stablecoin issuers and payment-related digital assets under the Payment Systems and Stored Value Facilities Ordinance and the forthcoming Stablecoin Ordinance.

The Financial Services and the Treasury Bureau (FSTB) sets overarching policy direction. Together, these bodies form a framework that distinguishes between security tokens, utility tokens, payment tokens and stablecoins - each attracting different rules and different regulators.

The AMLO amendment that took effect in recent years created the mandatory VASP licensing regime. Before this change, crypto exchanges could operate under a voluntary opt-in scheme. Now, any platform that offers trading services in virtual assets to Hong Kong retail or professional investors must hold an SFC licence, regardless of where it is incorporated.

A non-obvious requirement is that the licensing obligation applies to platforms that actively market to Hong Kong users even if the platform itself is domiciled offshore. Operators who assumed that a non-Hong Kong entity exempted them from local rules have found themselves in breach.

The VASP licence is the central instrument of crypto regulation in Hong Kong for exchange operators. Applicants must satisfy the SFC that they meet standards across financial soundness, governance, cybersecurity, anti-money laundering (AML) controls, and investor protection.

Key eligibility conditions include:

• Incorporation in Hong Kong or registration as a registered non-Hong Kong company
• At least two responsible officers approved by the SFC
• Minimum liquid capital requirements maintained on an ongoing basis
• Segregation of client assets from proprietary assets
• Insurance or compensation arrangements for client holdings

The application process involves submitting a detailed business plan, internal policy manuals, AML/CFT programme documentation, cybersecurity audit reports and audited financial statements. The SFC conducts a fit-and-proper assessment of all directors, responsible officers and substantial shareholders.

In practice, the SFC review process has taken between six and eighteen months depending on the completeness of the application and the complexity of the business model. Applicants who submit incomplete documentation or whose AML frameworks do not meet the Financial Action Task Force (FATF) Travel Rule requirements face significant delays or outright rejection.

A common mistake is underestimating the Travel Rule obligation. Under Hong Kong';s implementation of the FATF Travel Rule, VATPs must collect and transmit originator and beneficiary information for virtual asset transfers above a threshold. Platforms that have not built compliant technical infrastructure before applying face rejection or conditional approval with remediation timelines.

Retail access is a particularly sensitive area. The SFC has issued specific guidance on which tokens may be offered to retail investors - only tokens included in at least two "acceptable indices" maintained by independent index providers qualify. This significantly narrows the range of assets a licensed platform can list for non-professional investors.

Hong Kong has introduced a dedicated stablecoin licensing regime, making it one of the first jurisdictions globally to regulate fiat-referenced stablecoins through bespoke legislation rather than adapting existing payment or securities law. The Stablecoin Ordinance, developed by the HKMA, requires any entity that issues a fiat-referenced stablecoin in Hong Kong, or issues one that references the Hong Kong dollar, to hold an HKMA stablecoin issuer licence.

The regime imposes strict reserve requirements. Issuers must hold reserve assets of at least equivalent value to outstanding stablecoins, with reserves held in high-quality liquid assets and subject to independent audit. The HKMA has the power to direct an issuer to redeem stablecoins at par on demand.

Governance requirements mirror those applied to banks in some respects: issuers must maintain a local management presence, appoint a board with independent directors, and submit to regular supervisory reviews. The HKMA sandbox programme allowed selected participants to test stablecoin issuance under regulatory oversight before the full regime came into force.

A practical scenario: a fintech company incorporated in Singapore that issues a USD-pegged stablecoin and actively distributes it to Hong Kong users through a local wallet application would require an HKMA stablecoin issuer licence. The fact of Singapore incorporation does not provide an exemption if the stablecoin is marketed or used in Hong Kong.

Foreign stablecoin issuers whose coins are widely used in Hong Kong but who have no local presence face a difficult compliance position. The HKMA has indicated it will take an activity-based approach, meaning the nexus to Hong Kong users, not the place of incorporation, determines whether the licence obligation is triggered.

AML and counter-terrorist financing compliance is the most operationally demanding aspect of crypto regulation in Hong Kong. The AMLO sets the primary legal framework, and the SFC and HKMA have each issued detailed guidelines that supplement the statute.

Licensed VATPs must implement a risk-based AML/CFT programme that includes:

• Customer due diligence (CDD) and enhanced due diligence for higher-risk clients
• Ongoing transaction monitoring with automated screening against sanctions lists
• Suspicious transaction reporting to the Joint Financial Intelligence Unit (JFIU)
• Record-keeping for a minimum of six years
• Travel Rule compliance for transfers above the applicable threshold

The Travel Rule in Hong Kong requires VATPs to collect and transmit the name, account number and address of the originator, and the name and account number of the beneficiary, for transfers at or above the threshold set by the AMLO. Transfers to or from unhosted wallets require additional due diligence steps, including verification of wallet ownership.

Many operators underestimate the complexity of Travel Rule implementation when counterparties are not licensed VATPs. Where the receiving entity is an unregulated offshore exchange, the Hong Kong VATP must apply enhanced scrutiny and may need to decline the transfer if it cannot satisfy its AML obligations.

Penalties for AML non-compliance are serious. The AMLO provides for criminal liability for senior management in cases of wilful or reckless breach, in addition to civil penalties and licence suspension or revocation. The SFC has demonstrated willingness to take enforcement action, including public reprimands and licence conditions.

If your platform is navigating Travel Rule implementation or AML programme design, contact info@vlolawfirm.com. We can assist with documents and filings, and help structure the compliance framework correctly from the outset.

Hong Kong does not impose capital gains tax, which makes it structurally attractive for crypto investors and traders. Gains from the disposal of virtual assets are not taxable where they are capital in nature. However, profits from trading in virtual assets that are considered to arise from a trade or business carried on in Hong Kong are subject to profits tax.

The Inland Revenue Department (IRD) applies a source-based taxation principle. Only profits arising in or derived from Hong Kong are taxable. This means that a crypto fund managed from Hong Kong but investing in offshore assets may have a strong argument that its profits are offshore-sourced and therefore not subject to Hong Kong profits tax, though the analysis depends heavily on where the key decision-making activities occur.

The IRD has issued guidance on the tax treatment of initial coin offerings, mining income, staking rewards and DeFi returns. The general principle is that receipts that are revenue in nature and arise from a Hong Kong business are taxable. Staking rewards received by a professional trader operating from Hong Kong are likely to be taxable income; staking rewards received by a passive investor may be treated differently.

A practical scenario: a family office incorporated in Hong Kong that holds Bitcoin and Ethereum as long-term investments and occasionally rebalances its portfolio would likely argue that its disposal gains are capital in nature and therefore not subject to profits tax. The IRD would examine the frequency of trading, the holding period, the purpose of acquisition and the financing arrangements to determine whether the activity constitutes a trade.

Crypto businesses should also consider stamp duty, which applies to transfers of Hong Kong stock. Security tokens that are classified as shares or stock under the Stamp Duty Ordinance may attract stamp duty on transfer, adding a transaction cost that pure utility or payment tokens do not face.

Entering the Hong Kong crypto market requires a structured approach. The regulatory timeline is not short, and operators who begin the licensing process without adequate preparation routinely encounter delays that cost months of operational time.

The first step is a regulatory mapping exercise: determining which activities the business conducts, which regulator has jurisdiction, and which licence or exemption applies. A platform that offers spot trading, derivatives, custody and OTC services may need to engage both the SFC and the HKMA, and may require multiple approvals.

Corporate structuring matters significantly. The SFC expects the licensed entity to be the operational entity, not a holding company or a shell. Responsible officers must be genuinely involved in the management of the business and must pass the SFC';s fit-and-proper assessment. Nominees or figureheads do not satisfy this requirement.

Technology infrastructure must be built to regulatory specification before the application is submitted. This includes cybersecurity systems meeting the SFC';s cybersecurity guidelines, cold storage arrangements for client assets, and Travel Rule-compliant transaction monitoring. Retrofitting these systems after a licence is granted, or during a conditional approval period, is significantly more expensive than building them correctly at the outset.

Ongoing compliance obligations after licensing include monthly financial returns to the SFC, annual audited accounts, notification of material changes to business or ownership, and periodic cybersecurity audits. The SFC conducts on-site inspections and thematic reviews, and operators should maintain compliance documentation in a state of readiness for examination at any time.

For operators structuring their Hong Kong entry, contact info@vlolawfirm.com. We can help structure the setup correctly the first time, from entity formation through to licence application and ongoing compliance management.

What is the practical difference between a security token and a utility token under Hong Kong law?

The distinction matters because security tokens fall under the Securities and Futures Ordinance (SFO) and require SFC authorisation for public offering, while utility tokens generally do not. The SFC applies a substance-over-form analysis: if a token confers rights similar to shares, debentures or collective investment scheme interests - such as profit participation, voting rights or a claim on assets - it is likely a security token regardless of what the issuer calls it. Utility tokens that provide access to a service or product, with no investment return expectation, typically fall outside the SFO. In practice, many tokens have hybrid characteristics, and the SFC has issued guidance indicating that even a partial securities element can bring the entire token within the regulatory perimeter. Operators should obtain a legal opinion on token classification before any public issuance.

How long does the VASP licensing process take, and what are the main cost drivers?

The SFC review period has ranged from six to eighteen months in practice, depending on the quality and completeness of the application. The main cost drivers are legal and compliance advisory fees for preparing the application, technology costs for building compliant infrastructure, and the ongoing cost of maintaining the required liquid capital and insurance arrangements. Professional fees for a full VASP licence application from a qualified law firm and compliance consultancy typically run into the mid-to-high six figures in Hong Kong dollars for a straightforward application, and significantly more for complex business models. Applicants who submit incomplete or poorly structured applications face additional rounds of SFC queries, each of which extends the timeline and increases advisory costs. Engaging experienced counsel before submitting, rather than after receiving SFC queries, is consistently more cost-effective.

Can a foreign crypto exchange serve Hong Kong users without obtaining a local licence?

No. Since the mandatory VASP licensing regime came into force under the amended AMLO, any platform that actively markets to or serves Hong Kong users must hold an SFC VASP licence, regardless of where it is incorporated. The SFC takes an activity-based approach: the relevant question is whether the platform is providing virtual asset trading services to persons in Hong Kong, not whether the platform has a physical presence in Hong Kong. Offshore platforms that geo-block Hong Kong users and take no active steps to solicit Hong Kong business may fall outside the regime, but the SFC has been clear that passive availability of a platform to Hong Kong users, combined with any form of marketing directed at Hong Kong, is sufficient to trigger the licensing obligation. Operating without a licence exposes the platform and its senior management to criminal liability under the AMLO.

Hong Kong has established a comprehensive and enforceable framework for crypto regulation, covering exchanges, stablecoins, AML compliance and taxation. The regime is demanding but navigable for operators who plan carefully, build compliant infrastructure before applying, and engage with the SFC and HKMA proactively. The regulatory direction is toward greater institutional participation and retail investor protection, not restriction of the market.

VLO Law Firms advises international clients on crypto regulation in Hong Kong. We can assist with VASP licence applications, stablecoin regulatory analysis, AML programme design, token classification opinions and ongoing compliance management. To request a consultation, contact: info@vlolawfirm.com